holotable/docker-compose.yml at main · jbouder/holotable · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
services:
  postgres:
    image: timescale/timescaledb:2.17.2-pg16
    environment:
      POSTGRES_USER: holotable
      POSTGRES_PASSWORD: holotable
      POSTGRES_DB: holotable
      TS_METRICS_USERNAME: ${TS_METRICS_USERNAME:-metrics_ro}
      TS_METRICS_PASSWORD: ${TS_METRICS_PASSWORD:-readonly}
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./timescaledb/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U holotable"]
      interval: 5s
      timeout: 3s
      retries: 20

  keycloak:
    image: quay.io/keycloak/keycloak:26.0
    command: ["start-dev", "--import-realm"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
    ports:
      - "8080:8080"
    volumes:
      - ./keycloak:/opt/keycloak/data/import:ro

  migrate:
    build:
      context: .
    command: ["node", "node_modules/.bin/tsx", "scripts/migrate.ts"]
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-holotable}:${POSTGRES_PASSWORD:-holotable}@postgres:5432/holotable"
    depends_on:
      postgres:
        condition: service_healthy

  app:
    build:
      context: .
    environment:
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-holotable}:${POSTGRES_PASSWORD:-holotable}@postgres:5432/holotable"
      SESSION_SECRET: ${SESSION_SECRET:?set a strong 32+ char SESSION_SECRET}
      # Credentials the app resolves for the 'TS_METRICS' source secret_ref.
      TS_METRICS_USERNAME: ${TS_METRICS_USERNAME:-metrics_ro}
      TS_METRICS_PASSWORD: ${TS_METRICS_PASSWORD:-readonly}
      # AI provider (see .env.example / docs).
      AI_PROVIDER: ${AI_PROVIDER:-openai-compatible}
      AI_MODEL: ${AI_MODEL:-}
      OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      AI_GATEWAY_API_KEY: ${AI_GATEWAY_API_KEY:-}
      # Keycloak OIDC.
      OIDC_ISSUER: ${OIDC_ISSUER:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
      OIDC_JWKS_URL: ${OIDC_JWKS_URL:-}
      OIDC_GROUPS_CLAIM: ${OIDC_GROUPS_CLAIM:-groups}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
      OIDC_SCOPE: ${OIDC_SCOPE:-openid profile}
      OIDC_AUDIENCE: ${OIDC_AUDIENCE:-}
    ports:
      - "3000:3000"
    # OIDC URLs use localhost:8080 (browser-facing). Map localhost to the host
    # gateway so server-side JWKS/token fetches inside this container reach the
    # published Keycloak port instead of the container's own loopback.
    extra_hosts:
      - "localhost:host-gateway"
    depends_on:
      postgres:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully

  seed:
    build:
      context: .
    command: ["node", "node_modules/.bin/tsx", "scripts/seed.ts"]
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-holotable}:${POSTGRES_PASSWORD:-holotable}@postgres:5432/holotable"
      TIMESCALEDB_URL: "postgresql://${POSTGRES_USER:-holotable}:${POSTGRES_PASSWORD:-holotable}@postgres:5432/holotable"
      TS_METRICS_HOST: postgres
      TS_METRICS_PORT: "5432"
      SEED_INTERVAL_MS: "2000"
    depends_on:
      postgres:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully

volumes:
  pgdata: